I have a server where a partition (
/var) switched to read-only. So I try to reproduce this problem on another server with the following command.
mount -o remount,ro /var/ -f
When I check our application log on that same partition I remounted ro I see entries recently added.
tail -f /var/log/httpd/*